Fallos del tipo CWE-400

3034 resultados

Consumo descontrolado de recursos (esgotamento)

A aplicação não limita adequadamente o consumo de recursos (memória, CPU, conexões, disco) em resposta a requisições do usuário ou eventos externos. Um atacante explora isso enviando muitas requisições ou dados grandes para derrubar o serviço, indisponibilizando-o para usuários legítimos.

Ejemplo

Um endpoint de upload aceita arquivos sem limitar o tamanho ou taxa de envio; um atacante manda gigabytes contínuos até a aplicação ficar sem espaço em disco ou memória. Ou um loop sem condição de parada processa dados de entrada indefinidamente, travando a CPU.

Cómo mitigar

Implemente limites explícitos: tamanho máximo de arquivo/requisição, rate limiting (requisições por IP/usuário), timeouts, pool de conexões com tamanho fixo, e monitoramento de recursos. Valide e rejeite early entradas que excedem esses limites.

CVE-2025-30158HIGHNamelessMC Forum iframe width/height abuse causing UI-based Denial of ServiceEPSS 0.5%CVE-2026-83600MEDIUMNetdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agentEPSS 0.5%CVE-2026-9165HIGHStackrox: stackrox: unbounded graphql query depth allows authenticated denial of serviceEPSS 0.5%CVE-2026-73559MEDIUMvLLM: Completion prompt lists fan out into unbounded engine requestsEPSS 0.5%CVE-2026-30405HIGHAn issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attributeEPSS 0.5%CVE-2026-52814MEDIUMGogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)EPSS 0.5%CVE-2025-21549HIGHVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). The supported version that is affected EPSS 0.5%CVE-2026-85100MEDIUM2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumptionEPSS 0.5%CVE-2024-3056HIGHPodman: kernel: containers in shared ipc namespace are vulnerable to denial of service attackEPSS 0.5%CVE-2026-92363MEDIUMag-ui-protocol ag-ui JSON sse_parser.cpp resource consumptionEPSS 0.5%CVE-2025-27669HIGHVasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS EPSS 0.5%CVE-2026-50018MEDIUMHoverfly: Denial of Service via Goroutine Leak in Remote Post-Serve ActionsEPSS 0.5%CVE-2024-7567MEDIUMRockwell Automation Micro850/870 Vulnerable to denial-of-service Vulnerability via CIP/Modbus PortEPSS 0.5%CVE-2026-86452HIGHMISP Unauthenticated Mail Endpoints Allow Unbounded Storage Consumption and Request FloodingEPSS 0.5%CVE-2026-46627HIGHTwig: Sandbox resource exhaustion via unbounded `for` / `range()`EPSS 0.5%CVE-2026-44240HIGHbasic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingEPSS 0.5%CVE-2026-28872HIGHA resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and EPSS 0.5%CVE-2023-23925HIGHSwitcher Client contains Regular Expression Denial of Service (ReDoS)EPSS 0.5%CVE-2024-34688HIGHDenial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)EPSS 0.5%CVE-2025-55972HIGHA TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) EPSS 0.5%